CVE-2024-40117 is an access control vulnerability identified in Solar-Log 1000 devices prior to version 2.8.2 and build 52-23.04.2013. The root cause is improper enforcement of access control mechanisms on the web administration interface, which allows attackers to connect remotely without authentication and obtain administrative privileges. This flaw violates the principle of least privilege and allows full control over the device, including configuration changes, data access, and potentially disrupting device operations. The vulnerability is categorized under CWE-284 (Improper Access Control). It does not affect other Solar-Log models such as SL 200, 500, or 1000 (post-fix versions). Remediation has been applied in versions 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway, and in versions 5.1.2 and 6.0.0 for SL Base devices. The CVSS v3.1 base score is 9.8, reflecting the vulnerability’s ease of exploitation (network vector, no privileges or user interaction required) and its severe impact on confidentiality, integrity, and availability. Although no active exploits have been reported, the critical nature of the flaw demands immediate attention from affected organizations.

The vulnerability allows unauthenticated remote attackers to gain full administrative control over Solar-Log 1000 devices, which are commonly used for energy monitoring and management. This can lead to unauthorized access to sensitive operational data, manipulation or disruption of device functions, and potential interference with energy infrastructure monitoring. The compromise of such devices could impact operational continuity, data integrity, and confidentiality, potentially causing financial losses, regulatory non-compliance, and reputational damage. Given the critical CVSS score, exploitation could also enable attackers to pivot into broader network environments if these devices are connected to enterprise networks. The lack of required authentication and user interaction significantly increases the risk of automated or mass exploitation attempts once the vulnerability becomes widely known.

Organizations should immediately identify any Solar-Log 1000 devices running versions prior to 2.8.2 and build 52-23.04.2013. The primary mitigation is to upgrade affected devices to the fixed firmware versions provided by the vendor. If immediate patching is not feasible, network-level mitigations should be applied, including restricting access to the web administration interface via firewall rules or network segmentation to trusted management networks only. Monitoring and logging access attempts to the web interface should be enhanced to detect suspicious activity. Additionally, organizations should review and harden device configurations, disable unnecessary services, and implement strong network access controls. Vendor advisories should be closely followed for any updated patches or mitigation guidance. Regular vulnerability scanning and penetration testing targeting these devices can help identify residual risks.